peter bassill · operator
$ cve CVE-2021-25369 JSON

CVE-2021-25369 KEV

6.2
MEDIUM · CVSS 3.1 · EPSS 1.1% (pctl 65)

Patch first

On CISA KEV — known exploited in the wild, due 2022-11-29.

Description

An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.

Scoring

CVSS6.2 (MEDIUM, v3.1)
VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS1.12% — more likely to be exploited than 65% of all CVEs
WeaknessCWE-200
On CISA KEVyes — remediate by 2022-11-29
Public exploitnone known
Published2021-03-26
Last modified2026-06-17

CISA KEV

NameSamsung Mobile Devices Improper Access Control Vulnerability
Added2022-11-08
Due2022-11-29
Vendor / productSamsung / Mobile Devices
Ransomware usenone reported

Affected (1)

VendorProduct
samsungandroid

References

→ the Explorer  ·  watch your stack  ·  NVD